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REMARKS 

By this Amendment, Applicant amends the claims to correct the informality noted by 
the Examiner as well as correct additional noted informalities. Claims 1-5, 8-12, 14 and 16- 
20 are pending. 

TRAVERSAL OF 35 U.S.C 112 REJECTION 

Claims I, 9, 12, 14, 16, 18 and 20 were rejected under 35 U.S.C. §112, first 
paragraph, for containing allegedly unsupported and newly added features. Specifically the 
Office Action asserted that the clam language "solely" is allegedly not supported by the 
Examiner because the specification allegedly fails to state that a current location is 
determined only or solely using the IP address. 

Applicant directs the Offices attention to the specification from page 8, line 36 to 
page 9, line 1, which explains that the simplest way to determine the current location of the 
laptop is based on the currently used IP address only. Thus, claims 1, 9, 12, 14, 16, 18 and 20 
are supported in the specification. 

35 U.S.C. 103 REJECTIONS TRAVERSAL 

Claims 1-5, 8, 10-12 and 14 were rejected under 35 U.S.C. 103(a) as being obvious 
from Freund (US patent application publication 2003/0167405; hereafter Freund *405) in 
view of Freund (US 2003/0055962; hereafter Freund '962). Claims 9, 16, 17 and 19 were 
rejected under 35 U.S.C. 103(a) as being obvious from Freund '405, Freund '962 and 
Schneier (US 2002/0087882). Claims 11, 18 and 20 were rejected under 35 U.S.C. 103(a) as 
being obvious from Freund '405 and Sheikh (2002/0078382). Applicant traverses the prior 
art rejections because the cited prior art, analyzed individually or in combination, fails to 
teach or suggest all the features recited in the rejected claims. 

For example, the cited prior art fails to disclose, teach or suggest the claimed 
invention wherein the personal firewall determines a current location of said client computer 
based solely on an Internet Protocol (IP) address currently used by the client computer. 

Freund '405 fails to teach a personal firewall that determines a current location of the 
client computer based solely on an IP address. To the contrary, Freund '405 actually teaches 
away from the claimed invention by stating that the IP address, as such, is insufficient to 
determine a client computer's location (see paragraph 30). Rather, Freund '405 teaches using 
an Operating System (OS) network information Application Programming Interface (MI) to 
determine whether a network adapter (such as a modem, a network interface card, etc.) has 
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been added or removed from the client device, or whether such an adapter's network 
configuration has changed. In other words, network characteristics are detected based on the 
network configuration information from a network adapter of a client device. 

Freund '405 also fails to teach that the firewall verifies the determined location 
determined based solely on the IP address, by a request-response procedure with a 
predetermined network element selected based on the current IP address, prior to selecting 
security rules for that network. The Office Action recognized that Freund '405 fails to teach 
that feature but referred to paragraphs [0092], [0125], [00127] of Freund '962 as teaching this 
feature. 

However, that passage of Freund '962 merely teaches that a client registers itself to a 
router. Thus, Freund * 962, analyzed individually or in combination with Freund '405, foils to 
teach that the firewall verifies the determined location determined based solely on the IP 
address, by a request-response procedure with a predetermined network element selected 
based on the current IP address, prior to selecting security rules for that network. 

Thus, the combined teachings of Freund '405 and Freund '962 fail to disclose, teach 
or suggest all the features recited in the rejected claims: 

Similarly, Schneier fails to remedy these deficiencies of Freund '405 and Freund '962 
because Schneier merely teaches on the subject of a probe attached to a customer's network 
that collects status data and other audit information from monitored components of the 
network, looking for footprints or evidence of unauthorized intrusions or attacks and filters 
and analyzes the collected data to identify potentially security-related events happening on 
the network. Thus, the combined teachings of Freund '405, Freund '962 and Schneier fail to 
disclose, teach or suggest all the features recited in the rejected claims. 

Finally, Sheikh fails to remedy these deficiencies of the other cited prior art because 
Sheikh merely teaches on the subject of a security software methodology and system that 
monitors configuration changes made to information systems within a network, which 
include applications including web servers, firewalls, proxy servers, log servers, intrusion 
detection software systems, routers and any other device or application which can be 
considered a part of the enterprise information system infrastructure. Thus, the combined 
teachings of the prior art fail to disclose, teach or suggest all the features recited in the 
rejected claims. 

Accordingly the prior art rejections are traversed because the claimed features are not 
taught or suggested by any combination of the prior art. 
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